JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.251.168.98

20.251.168.98 was found in our database!

This IP was reported 69 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇳🇴 Norway
City	Oslo, Oslo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.251.168.98

Whois 20.251.168.98

IP Abuse Reports for 20.251.168.98:

This IP address has been reported a total of 69 times from 43 distinct sources. 20.251.168.98 was first reported on June 23rd 2025, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-26 06:00:00 (22 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇩🇪 maxpower	2026-07-25 15:54:45 (1 day ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the la ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.251.168.98 - - [25/Jul/2026:17:54:42 +0200] "GET //vendor/phpunit/phpunit/phpunit.xsd HTTP/2.0" 301 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "20.251.168.98" host=marialauracaselli.com show less	Port Scan
🇩🇪 maxpower	2026-07-25 13:34:46 (1 day ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the la ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.251.168.98 - - [25/Jul/2026:15:34:41 +0200] "GET //vendor/phpunit/phpunit/phpunit.xsd HTTP/1.1" 301 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "20.251.168.98" host=abruzzotour.it show less	Port Scan
🇵🇱 sefinek.net	2026-07-25 12:35:01 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from NO. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoi ... show more Triggered Cloudflare WAF (firewallCustom) from NO. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: //vendor/phpunit/phpunit/phpunit.xsd \| UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 maxpower	2026-07-25 11:34:35 (1 day ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the la ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.251.168.98 - - [25/Jul/2026:13:34:33 +0200] "GET //vendor/phpunit/phpunit/phpunit.xsd HTTP/1.1" 301 308 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "20.251.168.98" host=tikitakaplanet.it show less	Port Scan
🇷🇺 Reaper	2026-07-25 11:16:07 (1 day ago)	GET //vendor/phpunit/phpunit/phpunit.xsd	Web App Attack
🇩🇪 maxpower	2026-07-25 10:55:15 (1 day ago)	(PERMBLOCK) 20.251.168.98 (NO/Norway/-) has had more than 4 temp blocks in the last 86400 secs; Port ... show more (PERMBLOCK) 20.251.168.98 (NO/Norway/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇺🇸 Lezetho	2026-07-25 10:00:16 (1 day ago)	DDoS, WebSpam, Web Attack, and Brute-force blocked by Cloudflare	DDoS Attack Email Spam Hacking Brute-Force
🇩🇪 maxpower	2026-07-25 09:54:15 (1 day ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the la ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.251.168.98 (NO/Norway/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.251.168.98 - - [25/Jul/2026:11:54:10 +0200] "GET //vendor/phpunit/phpunit/phpunit.xsd HTTP/2.0" 404 201 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "20.251.168.98" host=liverpoolitalia.it show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-25 08:55:55 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 20.251.168.98 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 20.251.168.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 04:55:50.739148 2026] [security2:error] [pid 1070978:tid 1070978] [client 20.251.168.98:51003] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.swcbsa.org\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.swcbsa.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "amR6FvvclMlwoDqYmFit-AAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 MatStef132	2026-07-25 06:53:15 (1 day ago)	MatShield L7: blocked on dzielnicarp.eu (fivem-ua-not-allowed)	DDoS Attack
🇨🇦 internetworld	2026-07-25 06:06:18 (1 day ago)	internetworld-prod-01 Fail2Ban ban. Jail=nginx-web-probe-iw. Sanitized automatic report from interne ... show more internetworld-prod-01 Fail2Ban ban. Jail=nginx-web-probe-iw. Sanitized automatic report from internetworld.ca server security monitoring. show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 05:08:45 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 20.251.168.98 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 20.251.168.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 01:08:39.410907 2026] [security2:error] [pid 16833:tid 16833] [client 20.251.168.98:49883] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.floridausa.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.floridausa.com"] [uri "/wmia/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "amRE1w4mmLEr-yrhpOQ9TQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 04:04:35 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 20.251.168.98 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 20.251.168.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 00:04:31.824969 2026] [security2:error] [pid 14917:tid 14917] [client 20.251.168.98:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|jspsf.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jspsf.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "amQ1z3hbxi_1WN-84XV0kQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Mundo Bueno	2026-07-25 03:59:50 (2 days ago)	[ISILIA Protection v2.1] Tentative d'accès: //vendor/phpunit/phpunit/phpunit.xsd \| Pays: NO \| UA: Mo ... show more [ISILIA Protection v2.1] Tentative d'accès: //vendor/phpunit/phpunit/phpunit.xsd \| Pays: NO \| UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 show less	Hacking Web App Attack

Showing 1 to 15 of 69 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 170.82.254.8

🇺🇸 165.227.62.247

🇺🇸 159.65.216.50

🇷🇺 109.120.21.142

🇯🇵 92.113.142.203

🇺🇸 66.132.172.200

🇩🇪 4.184.121.217

🇰🇷 3.34.195.8

🇺🇸 2607:f8b0:4001:c22::12d

🇩🇪 213.209.159.114

🇺🇸 205.210.31.65

🇨🇳 203.110.233.225

🇨🇳 120.48.147.81

🇲🇲 37.111.53.110

🇬🇧 2.57.17.139

🇨🇳 218.68.218.121

🇧🇷 205.210.31.202

🇺🇸 192.3.176.32

🇨🇴 181.51.34.74

🇧🇷 170.0.62.165